# Encrypt / secure Database password in logstash.conf file

**URL:** <https://discuss.elastic.co/t/encrypt-secure-database-password-in-logstash-conf-file/210137>\
**Category:** Logstash\
**Tags:** elastic-stack-security\
**Created:** [December 2, 2019, 8:30am UTC](https://discuss.elastic.co/t/encrypt-secure-database-password-in-logstash-conf-file/210137 "2019-12-02T08:30:07Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![sampath1](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@sampath1](https://discuss.elastic.co/u/sampath1)\
**Post date:** [December 2, 2019, 8:30am UTC](https://discuss.elastic.co/t/encrypt-secure-database-password-in-logstash-conf-file/210137/1 "2019-12-02T08:30:07Z")

</div>

Hi,

I am new to this Logstash.  
I don't want to specify plain text "username" and "password" in logstash.conf for the Database input plugin. Is there any way to do that?

Is there any possible way to encrypt or hide the DB "username" and "password." in log stash config code?

Elastic Search Version 7.0.0  
Logstash version 7.0.0

logstash.conf file

input {  
jdbc {  
jdbc\_connection\_string =\> "jdbc:postgresql://DbIP:port/DatabaseName"  
jdbc\_user =\> "dbuser"  
jdbc\_password =\> " **dbpassword**"  
jdbc\_driver\_class =\> "org.postgresql.Driver"  
jdbc\_driver\_library =\> "/home/Downloads/postgresql-42.1.4.jar"  
jdbc\_validate\_connection =\> true  
statement =\> 'select \*from order\_tbl'  
use\_column\_value =\> true  
tracking\_column\_type =\>"numeric"  
tracking\_column =\> "ford\_id"  
clean\_run =\> true  
}  
}  
output {  
elasticsearch {  
user =\> ESUser  
password =\> ESPassword  
ssl =\> true  
sniffing =\> true  
index =\> "1\_999"  
document\_type =\> "1\_999"  
document\_id =\> "%{ford\_id}"  
hosts =\> ["[https://ESIp](https://ESIp):Port"]  
}  
}

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [December 2, 2019, 8:40am UTC](https://discuss.elastic.co/t/encrypt-secure-database-password-in-logstash-conf-file/210137/2 "2019-12-02T08:40:28Z")

</div>

hi,

Yes, we explain how to do this in [https://www.elastic.co/guide/en/logstash/current/keystore.html](https://www.elastic.co/guide/en/logstash/current/keystore.html)

---

<div class="post-metadata">

**Author:** ![sampath1](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@sampath1](https://discuss.elastic.co/u/sampath1)\
**Post date:** [December 2, 2019, 8:42am UTC](https://discuss.elastic.co/t/encrypt-secure-database-password-in-logstash-conf-file/210137/3 "2019-12-02T08:42:52Z")

</div>

Hi Ikakavas,

could you please explain in detail where to go and what need to be done.

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [December 2, 2019, 8:48am UTC](https://discuss.elastic.co/t/encrypt-secure-database-password-in-logstash-conf-file/210137/4 "2019-12-02T08:48:29Z")

</div>

Hi,

We put a lot of effort in our docs so that our users can find answers and solutions to their problems. There is little value in me writing the same things here again, especially without context on what in the docs where not comprehensible.

I shared a documentation link with you just 2 minutes ago, please read this first and make an attempt to solve the issue based on what we describe there. If you do come across any issues trying to apply the documentation, or something is not clear enough, someone in this community will be happy to help you out !

---

<div class="post-metadata">

**Author:** ![sampath1](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@sampath1](https://discuss.elastic.co/u/sampath1)\
**Post date:** [December 2, 2019, 9:08am UTC](https://discuss.elastic.co/t/encrypt-secure-database-password-in-logstash-conf-file/210137/5 "2019-12-02T09:08:12Z")

</div>

Hi,

Provided above link about protect elastic search "Password".

The syntax for referencing keys is identical to the syntax for [environment variables](https://www.elastic.co/guide/en/logstash/current/environment-variables.html):

`${KEY}`

Where KEY is the name of the key.

For example, imagine that the keystore contains a key called `ES_PWD` with the value `yourelasticsearchpassword` :

In configuration files, use: `output { elasticsearch {...password => "${ES_PWD}" } } }`  
In `logstash.yml` , use: `xpack.management.elasticsearch.password: ${ES_PWD}`

I am looking for the database "username" and "password" from the input plugin.  
This is hard code value in logstash config-\> jdbc\_user =\> "user" jdbc\_password =\> "password@abc" (this should not be "hardcode")

Below is my code

e.g:  
input {  
jdbc {  
jdbc\_connection\_string =\> "jdbc:mysql://000.000.00.000:000/Schemas name"  
# The user we wish to execute our statement as  
jdbc\_user =\> "user"  
jdbc\_password =\> "password@abc"  
# The path to our downloaded jdbc driver  
jdbc\_driver\_library =\> "C:\logstash-6.7.0\bin\mysql-connector-java-8.0.13.jar"  
jdbc\_driver\_class =\> "com.mysql.jdbc.Driver"  
# our query  
statement =\> "Select \* from Tablename "  
}  
}  
output {  
stdout { codec =\> json\_lines }  
elasticsearch {  
"hosts" =\> "9200"  
"index" =\> "test"  
"document\_type" =\> "data"  
}  
}

---

<div class="post-metadata">

**Author:** ![sampath1](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@sampath1](https://discuss.elastic.co/u/sampath1)\
**Post date:** [December 2, 2019, 11:02am UTC](https://discuss.elastic.co/t/encrypt-secure-database-password-in-logstash-conf-file/210137/6 "2019-12-02T11:02:39Z")

</div>

Hi all,

Still this feature under investigation?  
I have been seeing many links were users are asking for a long time.

> [@Jdbc\_password configuration for logstash](https://discuss.elastic.co/t/jdbc-password-configuration-for-logstash/35178):
>
> Is there a way to mask/hide the jdbc\_password parameter. Config File: input { jdbc { jdbc\_driver\_library =\> "C:\Program Files\DbVisualizer\jdbc\oracle\ojdbc6.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver" jdbc\_connection\_string =\> "jdbc:oracle:thin:@TEST:1244:TESTDB" jdbc\_user =\> "user\_id" #jdbc\_password =\> "" jdbc\_validate\_connection =\> true jdbc\_fetch\_size =\> 1000 schedule =\> "\* \* \* \* \*" statement =\> "Select EMP\_ID from Employee\_data" } } output { elasticsear…

> [@JDBC\_password config for logstash?](https://discuss.elastic.co/t/jdbc-password-config-for-logstash/210153):
>
> Continuing the discussion from [Jdbc\_password configuration for logstash](https://discuss.elastic.co/t/jdbc-password-configuration-for-logstash/35178/2): Any update on this?

> <https://github.com/sampath-v/sam/issues/1>
>
> Hi,
> 
> I am new to this Logstash.
> I don't want to specify plain text "username"… and "password" in logstash.conf for the Database input plugin. Is there any way to do that?
> 
> Is there any possible way to encrypt or hide the DB "username" and "password." in log stash config code? 
> 
> Elastic Search Version 7.0.0
> Logstash version 7.0.0
> 
> logstash.conf file
> 
> input {
> jdbc {
> jdbc\_connection\_string =\> "jdbc:postgresql://DbIP:port/DatabaseName"
> jdbc\_user =\> "dbuser"
> jdbc\_password =\> "\*\*dbpassword\*\*"
> jdbc\_driver\_class =\> "org.postgresql.Driver"
> jdbc\_driver\_library =\> "/home/Downloads/postgresql-42.1.4.jar"
> jdbc\_validate\_connection =\> true
> statement =\> 'select \*from order\_tbl'
> use\_column\_value =\> true
> tracking\_column\_type =\>"numeric"
> tracking\_column =\> "ford\_id"
> clean\_run =\> true
> }
> }
> output {
> elasticsearch {
> user =\> ESUser
> password =\> ESPassword
> ssl =\> true
> sniffing =\> true
> index =\> "1\_999"
> document\_type =\> "1\_999"
> document\_id =\> "%{ford\_id}"
> hosts =\> \["https://ESIp:Port"\]
> }
> }

> [@Encrypt / secure Database password in logstash.conf file](https://discuss.elastic.co/t/encrypt-secure-database-password-in-logstash-conf-file/210137/2):
>
> hi, Yes, we explain how to do this in [https://www.elastic.co/guide/en/logstash/current/keystore.html](https://www.elastic.co/guide/en/logstash/current/keystore.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 30, 2019, 11:02am UTC](https://discuss.elastic.co/t/encrypt-secure-database-password-in-logstash-conf-file/210137/7 "2019-12-30T11:02:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.